CVE-2026-72639

Executive Summary

CVE-2026-72639 is an unauthenticated-patch-denial-of-service vulnerability in Elasticsearch that allows an authenticated user with only read privileges on a single searchable index to trigger fatal memory exhaustion in a node via a single crafted search request. The flaw resides in the search highlighting feature, where a user-supplied count is not bounded and the subsequent memory allocation is not evaluated against circuit breakers prior to execution. The vulnerability requires low privilege and no user interaction, has a CVSS base score of 6.5 (High availability impact), and results in node termination, degrading cluster routing and health; a single small request is sufficient to trigger the condition, and the defect is not volumetric.

Technical Analysis

The vulnerability exists in Elasticsearch's search highlighting subsystem. The NVD description identifies that a user-supplied count parameter accepted by a search highlighting option lacks an upper bound enforcement, and the memory allocation derived from that count is not accounted against any circuit breaker.

Vulnerability Mechanism: The flaw is fundamentally a resource allocation issue (CWE-789 — Uncontrolled Memory Allocation). When a search request includes a highlighting configuration with a user-controlled count value, Elasticsearch proceeds to allocate an internal data structure sized according to that count before evaluating existing safety limits that govern highlighting.

Key technical observations:

1. Allocation-before-check ordering: The NVD description explicitly notes that "the allocation occurs before the existing highlighting safety limits are evaluated," indicating an integer or memory allocation check bypass in the control flow of the highlighting processing logic.
2. Authenticated prerequisite: The attacker must be an authenticated user with read privileges on at least one searchable index. This is a low-privilege requirement — no administrator or write access is necessary.
3. Non-volumetric trigger: The description emphasizes the defect is not volumetric and does not depend on the size of the indexed data. A single small request is sufficient to trigger the memory exhaustion. This distinguishes the attack from bulk-query or large-payload DoS techniques.
4. Fatal impact: The memory exhaustion causes "a fatal error that terminates the Elasticsearch node process," which means the node does not just degrade — it crashes outright.

Attack Surface: The attack surface is the Elasticsearch HTTP API (typically port 9200) or transport protocol interface, through which search queries are submitted. The vulnerability is exposed to any authenticated user with minimal read access, which in a typical cluster includes application service accounts, dashboards, and monitoring agents — significantly widening the exploitable surface compared to admin-only flaws.

Missing technical detail: The NVD description does not disclose the specific parameter name or endpoint (e.g., whether this relates to fragment_size, number_of_fragments, or a similar highlighting count option). Insufficient technical detail is available to enumerate the exact request payload structure. However, the vulnerability class is clear: uncontrolled memory allocation via a user-supplied count in a search highlighting option.

Exploitation Scenarios

1) Reconnaissance / Target Identification: An attacker first identifies an exposed Elasticsearch endpoint, commonly on TCP port 9200. Using Shodan or mass scans (product:elasticsearch port:9200), they enumerate clusters. They then probe for authentication requirements — many misconfigured clusters are exposed without authentication, but this vulnerability specifically requires valid credentials, so the attacker must obtain or leverage read-only credentials (e.g., compromised API keys, service account tokens, or credentials extracted from web application configurations that connect to the cluster).

2) Flaw Trigger: With read access to at least one searchable index, the attacker crafts a search request that includes a highlighting option containing an excessively large user-supplied count value. The exact parameter is not documented in the NVD description, but the mechanism is clear: a count field that drives a memory allocation within the highlighting subsystem. Because the allocation occurs before safety limit evaluation, the sentinel value that would normally cap resource usage is never reached.

3) Payload / Execution at Vulnerability-Class Level: At the vulnerability-class level (CWE-789 — Uncontrolled Memory Allocation), this is analogous to specifying a maximum result or fragment count that, when multiplied against per-result allocation sizes, causes the node's JVM heap to be exhausted. A single HTTP request with a JSON body containing a search query and a highlighting configuration with an absurdly large count value will force the JVM to attempt a large allocation, triggering OutOfMemoryError and terminating the node.

4) Post-Exploitation Impact: Once the node process crashes:

• The cluster loses that node's data shards and service capacity.
• If the node hosts primary shards, failover processes trigger, causing temporary unavailability for those indices.
• The cluster's health degrades to YELLOW or RED depending on replica availability.
• Repeated attacks against multiple nodes can cause cascading failures, potentially taking down the entire cluster.
• If the cluster relies on a single node (common in small deployments), this is equivalent to full service denial.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class. Exploitation requires knowledge of the specific Elasticsearch highlighting request structure, and without a PoC the exact triggering parameter remains undisclosed.

Impact Assessment

Business Impact: The vulnerability allows a low-privileged authenticated user to cause node-level denial of service. For organizations running Elasticsearch as a central log aggregation, search, or analytics platform, node termination translates directly to loss of search availability, delayed index ingestion, and degraded observability — which can cascade into operational blindness during security incidents or business-critical periods.

CVSS Breakdown: Base score 6.5 (Medium severity) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H:

• Attack Vector: Network — exploitable remotely via the network.
• Attack Complexity: Low — standard request crafting, no special conditions.
• Privileges Required: Low — only read access on one index needed.
• User Interaction: None — no victim interaction required.
• Scope: Unchanged — impact confined to the Elasticsearch node.
• Confidentiality/Integrity: None — no data theft or modification.
• Availability: High — complete node process termination.

Blast Radius: The primary impact is the targeted node; however, cluster-level effects occur due to shard rebalancing, health degradation, and potential cascading failure if the attacker targets multiple nodes or if the cluster topology is fragile. In single-node deployments, the blast radius is total service loss.

Affected Systems: Elasticsearch instances exposing search functionality to authenticated users. Any deployment where read-only credentials are distributed (dashboards, applications, monitoring) is exposed. The NVD description confirms the vulnerability is present in Elasticsearch but does not specify version ranges — insufficient technical detail is available to enumerate affected versions at this time.

EPSS: Not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Elasticsearch Excessive Memory Allocation via Search Highlighting
id: 7d2f9a13-0a33-4b8e-bdff-8b2c1a4f22aa
status: experimental
description: Detects Elasticsearch search requests containing highlighting configurations with abnormally large count values that could trigger uncontrolled memory allocation (CVE-2026-72639).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72639
author: Valtersit Threat Intel
date: 2026/02/15
tags:
    - attack.t1499
    - attack.t1499.003
    - cve.2026.72639
    - cwe.789
logsource:
    product: elasticsearch
    service: elasticsearch
    category: audit
detection:
    selection_highlight:
        request.body|contains:
            - '"highlight"'
            - 'highlight'
        request.body|contains|all:
            - 'number_of_fragments'
            - 'fragment_size'
    selection_large_count:
        request.body|contains|re:
            - 'number_of_fragments[\"']?\s*:\s*[0-9]{6,}'
            - 'fragment_size[\"']?\s*:\s*[0-9]{6,}'
    selection_read_user:
        user.roles|contains: 'read'
    condition: selection_highlight and selection_large_count and selection_read_user
level: high
falsepositives:
    - Legitimate configuration with very large fragment settings (unlikely beyond 6-digit magnitudes)
    - Monitoring tools that intentionally probe memory limits

YARA Rule

rule Elasticsearch_Highlighting_Excessive_Count_CVE_2026_72639
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Elasticsearch search requests crafted to trigger uncontrolled memory allocation via highlighting count (CVE-2026-72639)"
        cve = "CVE-2026-72639"
        date = "2026-02-15"
        severity = "high"
    strings:
        $highlight = "highlight" ascii wide nocase
        $search = "search" ascii wide nocase
        $fragments = "number_of_fragments" ascii wide nocase
        $fragment_size = "fragment_size" ascii wide nocase
        $large_number1 = /number_of_fragments[\"']?\s*:\s*[0-9]{7,}/ ascii
        $large_number2 = /fragment_size[\"']?\s*:\s*[0-9]{7,}/ ascii
        $json_body = "query" ascii wide
    condition:
        filesize < 100KB and
        $highlight and $search and $json_body and
        (($fragments and $large_number1) or ($fragment_size and $large_number2))
}

Suricata IDS Rule

alert http any any -> any 9200 (msg:"CVE-2026-72639 - Elasticsearch Excessive Highlighting Count Memory Exhaustion"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_search"; http.request_body; content:"highlight"; nocase; http.request_body; pcre:"/(number_of_fragments|fragment_size)\"\s*:\s*[0-9]{7,}/i"; sid:10072639; rev:1; classtype:attempted-dos; reference:cve,2026-72639; metadata:attack_target_es, deployment_datacenter, tag_dos;)

Elastic Detection

// Elastic EQL rule — audit log based
any where event.category == "audit" and
  event.action == "search" and
  /_search/ in url.path and
  (
    wildcard(http.request.body.text, "*number_of_fragments*") or
    wildcard(http.request.body.text, "*fragment_size*")
  ) and
  (
    // lookup for extremely large numeric values following the parameter
    regex(http.request.body.text, ".*(number_of_fragments|fragment_size)\\s*:\\s*[0-9]{7,}.*")
  ) and
  not user.name in ("kibana_system", "logstash_system")

sequence by host.name with maxspan=2m
  [ any where event.category == "audit" and event.action == "search" and
    regex(http.request.body.text, ".*(number_of_fragments|fragment_size)\\s*:\\s*[0-9]{7,}.*") ]
  [ any where event.category == "process" and
    wildcard(process.args, "*outOfMemory*") or
    event.action == "node_crash" ]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:audit
| where like(body, "%highlight%") OR like(body, "%number_of_fragments%") OR like(body, "%fragment_size%")
| regex body="(number_of_fragments|fragment_size)\"\s*:\s*[0-9]{7,}"
| rex field=body "user:(?<es_user>[^,}]+)" 
| rex field=body "index:(?<target_index>[^,}]+)"
| rex field=body "(number_of_fragments|fragment_size)\"\s*:\s*(?<count_val>[0-9]+)" 
| where tonumber(count_val) > 1000000
| stats count by src_ip, es_user, target_index, count_val, _time
| sort -_time
| rename src_ip as "Source IP", es_user as "ES User", target_index as "Target Index", count_val as "Suspect Count"

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-72639,">
    <rule id="100539" level="12" frequency="1">
        <if_sid>100001</if_sid>
        <field name="event.action">^search$</field>
        <field name="message">\.*number_of_fragments.*[0-9]{7,}</field>
        <description>CVE-2026-72639: Elasticsearch search request with excessive highlighting count detected. Possible memory exhaustion attempt.</description>
        <group>elasticsearch_dos,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
    <rule id="100540" level="12" frequency="1">
        <if_sid>100001</if_sid>
        <field name="event.action">^search$</field>
        <field name="message">\.*fragment_size.*[0-9]{7,}</field>
        <description>CVE-2026-72639: Elasticsearch search request with excessive fragment_size detected.</description>
        <group>elasticsearch_dos,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor (Elasticsearch/Elastic) has not released a fix as of this report.

1) Immediate Mitigations

• Restrict read access: Limit the number of users and service accounts with read privileges on any index. Audit existing read-only credentials and remove any that are unnecessary. Since only read access on a single index is required for exploitation, reducing the read-privileged population directly shrinks the attack surface.
• Network segmentation: Place Elasticsearch nodes behind a firewall or security group that restricts access to trusted application servers and administrative workstations only. Do not expose port 9200 directly to untrusted networks.
• Application-layer filtering: If traffic passes through an API gateway or WAF, add rules to inspect search requests for suspiciously large count values in highlighting parameters (e.g., values exceeding a reasonable threshold like 10,000) and block them.
• JVM heap monitoring: Enable aggressive heap usage alerting on Elasticsearch nodes. Set thresholds (e.g., alert at 75% heap usage) to detect attempted exploitation before the node terminates.
• Resource limits: If using containerized deployments, apply container-level memory cgroup limits to cap the JVM process, potentially causing request failure rather than full node crash.

2) Patch / Upgrade Steps

• Monitor for vendor advisory: Elastic will likely release a security advisory and patched versions. Track https://discuss.elastic.co/c/announcements/security-announcements and the Elastic security advisory page.
• When a patch becomes available: Apply the upgrade to the fixed version across all cluster nodes in a rolling fashion. Ensure cluster health is GREEN before and after the upgrade.
• Until patched: Treat this vulnerability as unmitigated in the code. The immediate mitigations above are the only defenses available.

3) Long-Term Hardening

• Least privilege enforcement: Implement fine-grained access control using Elasticsearch roles. Grant read privileges only to application accounts that genuinely require them, not broadly to all users.
• API key rotation: Rotate all API keys and service tokens periodically. Minimize the lifetime of granular-scope API keys that can access search APIs.
• Circuit breaker tuning: Review and explicitly set all circuit breaker limits (e.g., indices.breaker.total.limit, indices.breaker.request.limit) in the cluster configuration to conservative values that provide early protection against memory exhaustion.
• Node isolation: Consider separating search-heavy workloads onto dedicated nodes so a crash on a search node does not affect index ingestion nodes.
• Security monitoring: Deploy the detection rules above in the SIEM/IDS infrastructure to identify exploit attempts in real time.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72639
2. MITRE CWE-789: https://cwe.mitre.org/data/definitions/789.html
3. Elastic Security Advisories: https://discuss.elastic.co/c/announcements/security-announcements (monitor for official advisory)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-72639 is NOT on KEV at time of writing)
5. Elasticsearch Search API Documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-your-data.html (reference for highlighting request structure)

Exploit-in-the-Wild Evidence: None reported. No PoC, exploit code, or Nuclei template is publicly available as of this writing. No known threat actor campaigns are associated with this CVE. EPSS scoring has not yet been assigned by FIRST.org.

Report generated by Valtersit Threat Intelligence. This analysis is based solely on the NVD description and metadata provided. Technical specifics beyond the NVD description are inferred from the vulnerability class (CWE-789) and standard Elasticsearch behavior; they should be validated against your environment before operational use.